5 ms·

there are no good reasons we don't do this in the standards themselves, C, C++, and POSIX should all be working on editions that add safer APIs and mark unsafe

by raggi 5mo ago

there are no good reasons we don't do this in the standards themselves, C, C++, and POSIX should all be working on editions that add safer APIs and mark unsafe APIs as deprecated, to start a long term migration. we know how to do this, we've had a lot of success with this. there are real engineering concerns, sure, but they're not reasons to not do it. compilers and library chains can retain support for less safe variants for plenty of time.

zbentley 5mo ago
There are only two kinds of standards: ones that prioritize stability and backwards compatibility over usefulness and security, and ones nobody uses.
AlotOfReading 5mo ago
The reason this wasn't done by the standards committees is that they spent decades refusing to admit there was even a problem they could help fix. And if there was a problem, it was easily avoided by just writing better code. And if writing better code wasn't enough, well it was certainly too expensive to provide as a debug option. And if it wasn't too expensive to provide as a debug option, the implementors should really lead the way first. And on and on. The C committee at least seems to get it now. The C++ committee still doesn't, led in large part by Bjarne.
- uecker 5mo ago
  This is a misrepresentation based on a misunderstanding on how standardization works. The C standard committee has long recognized the need for better safety and carefully made it possible so that C could be implemented safely. But the process is that vendors implement something and then come together during standardization so that it is compatible, not that the standardization is the government that prescribes top-down what everybody has to do. Vendors did not bother to provide safer C implementations and safety features (such as bounds checking) did not get much attention from users in the past. So I am happy to see that there is now more interest in safety, because as soon as there solutions we can start putting them into the standard. (We can do some stuff before this, but this is always a bit of a fight with the vendors, because they do not like it at all if we tell them what to do, especially clang folks)
  - anthk 5mo ago
    Stop mixing C and C++, tons of people on Unix still hate C++ (Motif a bit less) for being un-Unixy and megacomplex, even more today. Die had Unix and C people created Plan9 and now Go, which is maybe the other succesor to C before Inferno and Limbo, where programming it's more simpler than the whole C and POSIX clusterfux (even Plan9 and 9front itself can be called a "Unix 2.0"). C++ is something else. Heck, it's often far more bound to a Windows domain (and for a while Be/Haiku) than Unix itself by a huge stretch.
    - uecker 5mo ago
      I agree, but are you responding to me?
    - elch 5mo ago
      It is probably worth noting that C++, like C/Unix, originated at AT&T Bell Labs and was originally referred to as "C with classes." Classes were implemented using a preprocessor. https://www.tuhs.org/Archive/Documentation/TechReports/USG_Library/1533_Classes_An_Abstract_Data_Type_Facility_for_the_C_Language.pdf https://www.tuhs.org/Archive/Documentation/TechReports/USG_L...
      - anthk 5mo ago
        Unix creators called Unix "dead and rotten" because the eulogy was done by Perl, and Plan9/9front and Inferno obliterated it. Ditto with C+POSIX against Plan9's C (and 9front) and Inferno vs Limbo, the grandparents of Golang, which is seen from Pike and so as the tool set C++ should have been. Golang it's like Windows NT. C++ it's like Windows ME, it might have their cases on RT performance and multimedia because of having far less layers than NT, (and much better on single core), but it crumbles down fast and it was really easy to shoot yourself in the foot. Windows 2000 and XP killed it for the good. Some day Golang would be performant enough (even with CSP) with multiple cores so all the 'performance' advanteges -suppossedly C++ brings- aren't needed at all. Even C# can be as good as C++ today in tons of cases (AOT and emulators like Ryuyinx are not a bluff), even SBCL for Common Lisp too if you finetune the compiling options.
- pjmlp 5mo ago
  Despite all security denial attitude, WG21 is doing much better than WG14. Still looking forward to the day C supports something like std::string, std::string_view, std::span, std:;array. Which starting with C++26 finally have a standards compliant story about having bounds checks enabled by default.
- pseudohadamard 5mo ago
  Yup, and its not just the standards committees. Look at TR 24731 as an example, an absolute no-brainer for security adding (shock, horror!) bounds checking to long-standing trouble-prone APIs that's been around for 20 years, and the response from most compiler writers/library authors has been "lalalalala I'm not listening I'm not listening". Even then it only got as far as it did due to relentless pressure from Microsoft, anyone else and it'd have been rejected outright. Having said that, some of it may be due to "it's from Microsoft, we can't ever use it". I'm actually surprised not to have seen any anti-MS diatribes in the discussion so far.
anthk 5mo ago
C and POSIX aren't related to C++ at all.
- raggi 5mo ago
  A vast number of C++ programs import C and POSIX headers directly, so the language level distinction you wish to make isn’t all that relevant to the subject matter.
sparkie 5mo ago
The C charter has a rule of "no invention". Anything needs to be demonstrated and used in practice before being included in the standard. The standard is only meant to codify existing practices, not introduce new ideas. It's up to compiler developers to ship first, standardize later.
- thayne 5mo ago
  That produces a bit of a chicken and egg probablem for a stdlib overhaul. Compilers and libc implementations don't have a strong reason to implement safer APIs, because if it is non-standard then projects that want to be portable won't use it , but it won't get standardized unless they do add safer APIs. So the best hope is probably for a third party library that has safet APIs to get popular enough that it becomes a de facto standard.
  - EPWN3D 5mo ago
    I think the real failing is that new language features then must be prototyped by people who have a background in compilers. That's a very small subset of the overall C community. I don't have any clue how to patch clang's front end. I'm not a language or compiler person. I just want to make stuff better. There needs to be a playground for people like me, and hopefully lib0xc can be that playground.
    - jstimpfle 5mo ago
      By adding to the language itself, you mostly make stuff worse. The major reason why C is useful is its quite stable syntax and semantics. Language is typically not the area where you want to add code. It's much better (and much easier) to invent function APIs. See how they shake out, if they're good you might get some adoption.
uecker 5mo ago
Well, there is Annex K which is based on a previous Microsoft effort. Almost universally it is considered terrible and few people implemented it.
- avadodin 5mo ago
  Immediately what I thought of when I saw /microsoft. Not all of the APIs were brain-dead. They just ignored all previous developments and in the proposal they didn't even remove the C++-related language.

by raggi 5mo ago

zbentley 5mo ago

There are only two kinds of standards: ones that prioritize stability and backwards compatibility over usefulness and security, and ones nobody uses.

AlotOfReading 5mo ago

The reason this wasn't done by the standards committees is that they spent decades refusing to admit there was even a problem they could help fix. And if there was a problem, it was easily avoided by just writing better code. And if writing better code wasn't enough, well it was certainly too expensive to provide as a debug option. And if it wasn't too expensive to provide as a debug option, the implementors should really lead the way first. And on and on. The C committee at least seems to get it now. The C++ committee still doesn't, led in large part by Bjarne.

uecker 5mo ago
This is a misrepresentation based on a misunderstanding on how standardization works. The C standard committee has long recognized the need for better safety and carefully made it possible so that C could be implemented safely. But the process is that vendors implement something and then come together during standardization so that it is compatible, not that the standardization is the government that prescribes top-down what everybody has to do. Vendors did not bother to provide safer C implementations and safety features (such as bounds checking) did not get much attention from users in the past. So I am happy to see that there is now more interest in safety, because as soon as there solutions we can start putting them into the standard. (We can do some stuff before this, but this is always a bit of a fight with the vendors, because they do not like it at all if we tell them what to do, especially clang folks)
- anthk 5mo ago
  Stop mixing C and C++, tons of people on Unix still hate C++ (Motif a bit less) for being un-Unixy and megacomplex, even more today. Die had Unix and C people created Plan9 and now Go, which is maybe the other succesor to C before Inferno and Limbo, where programming it's more simpler than the whole C and POSIX clusterfux (even Plan9 and 9front itself can be called a "Unix 2.0"). C++ is something else. Heck, it's often far more bound to a Windows domain (and for a while Be/Haiku) than Unix itself by a huge stretch.
  - uecker 5mo ago
    I agree, but are you responding to me?
  - elch 5mo ago
    It is probably worth noting that C++, like C/Unix, originated at AT&T Bell Labs and was originally referred to as "C with classes." Classes were implemented using a preprocessor. https://www.tuhs.org/Archive/Documentation/TechReports/USG_Library/1533_Classes_An_Abstract_Data_Type_Facility_for_the_C_Language.pdf https://www.tuhs.org/Archive/Documentation/TechReports/USG_L...
    - anthk 5mo ago
      Unix creators called Unix "dead and rotten" because the eulogy was done by Perl, and Plan9/9front and Inferno obliterated it. Ditto with C+POSIX against Plan9's C (and 9front) and Inferno vs Limbo, the grandparents of Golang, which is seen from Pike and so as the tool set C++ should have been. Golang it's like Windows NT. C++ it's like Windows ME, it might have their cases on RT performance and multimedia because of having far less layers than NT, (and much better on single core), but it crumbles down fast and it was really easy to shoot yourself in the foot. Windows 2000 and XP killed it for the good. Some day Golang would be performant enough (even with CSP) with multiple cores so all the 'performance' advanteges -suppossedly C++ brings- aren't needed at all. Even C# can be as good as C++ today in tons of cases (AOT and emulators like Ryuyinx are not a bluff), even SBCL for Common Lisp too if you finetune the compiling options.
pjmlp 5mo ago
Despite all security denial attitude, WG21 is doing much better than WG14. Still looking forward to the day C supports something like std::string, std::string_view, std::span, std:;array. Which starting with C++26 finally have a standards compliant story about having bounds checks enabled by default.
pseudohadamard 5mo ago
Yup, and its not just the standards committees. Look at TR 24731 as an example, an absolute no-brainer for security adding (shock, horror!) bounds checking to long-standing trouble-prone APIs that's been around for 20 years, and the response from most compiler writers/library authors has been "lalalalala I'm not listening I'm not listening". Even then it only got as far as it did due to relentless pressure from Microsoft, anyone else and it'd have been rejected outright. Having said that, some of it may be due to "it's from Microsoft, we can't ever use it". I'm actually surprised not to have seen any anti-MS diatribes in the discussion so far.

anthk 5mo ago

C and POSIX aren't related to C++ at all.

raggi 5mo ago
A vast number of C++ programs import C and POSIX headers directly, so the language level distinction you wish to make isn’t all that relevant to the subject matter.

sparkie 5mo ago

The C charter has a rule of "no invention". Anything needs to be demonstrated and used in practice before being included in the standard. The standard is only meant to codify existing practices, not introduce new ideas. It's up to compiler developers to ship first, standardize later.

thayne 5mo ago
That produces a bit of a chicken and egg probablem for a stdlib overhaul. Compilers and libc implementations don't have a strong reason to implement safer APIs, because if it is non-standard then projects that want to be portable won't use it , but it won't get standardized unless they do add safer APIs. So the best hope is probably for a third party library that has safet APIs to get popular enough that it becomes a de facto standard.
- EPWN3D 5mo ago
  I think the real failing is that new language features then must be prototyped by people who have a background in compilers. That's a very small subset of the overall C community. I don't have any clue how to patch clang's front end. I'm not a language or compiler person. I just want to make stuff better. There needs to be a playground for people like me, and hopefully lib0xc can be that playground.
  - jstimpfle 5mo ago
    By adding to the language itself, you mostly make stuff worse. The major reason why C is useful is its quite stable syntax and semantics. Language is typically not the area where you want to add code. It's much better (and much easier) to invent function APIs. See how they shake out, if they're good you might get some adoption.

uecker 5mo ago

Well, there is Annex K which is based on a previous Microsoft effort. Almost universally it is considered terrible and few people implemented it.

avadodin 5mo ago
Immediately what I thought of when I saw /microsoft. Not all of the APIs were brain-dead. They just ignored all previous developments and in the proposal they didn't even remove the C++-related language.